Hi,
a) You can do the scoring with a mathematical function which only after transformation offers the value you want. -> This would force the attacker to break the function instead of just looking up the value.
b) Use a graphical representation instead of showing just scorenumbers. -> The sniffer doesn't known exactly what to look after.
c) Cipher the data you want to transmit from the client to the server. You can also add control and junk data to it. -> Makes intercepting the transmission harder and gives you afterwards the possibility to check if the score could realistically be achieved.
d) Do not just use a hobby self made eor or something like that.
e) Do the decoding of the ciphered or transformed data only on the server-side and configure your server well.
f) Add automatic control mechanisms according to the control data on the server-side. Which when interpreting the scorelist filters those out which do not make sense or seem to be suspicious. You can delete those or keep them stored in a second list to know who tried to just in case you wanna exclude them for future projects.
My experience for online-games is that the criminal energy is there to an astounding amount as soon as there is something to win...
Greetings,
taumel
a) You can do the scoring with a mathematical function which only after transformation offers the value you want. -> This would force the attacker to break the function instead of just looking up the value.
b) Use a graphical representation instead of showing just scorenumbers. -> The sniffer doesn't known exactly what to look after.
c) Cipher the data you want to transmit from the client to the server. You can also add control and junk data to it. -> Makes intercepting the transmission harder and gives you afterwards the possibility to check if the score could realistically be achieved.
d) Do not just use a hobby self made eor or something like that.
e) Do the decoding of the ciphered or transformed data only on the server-side and configure your server well.
f) Add automatic control mechanisms according to the control data on the server-side. Which when interpreting the scorelist filters those out which do not make sense or seem to be suspicious. You can delete those or keep them stored in a second list to know who tried to just in case you wanna exclude them for future projects.
My experience for online-games is that the criminal energy is there to an astounding amount as soon as there is something to win...
Greetings,
taumel